4d381381d20a635686703ba119afc32a_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4d381381d20a635686703ba119afc32a_mafia_JC.exe
Size

163KB
MD5

4d381381d20a635686703ba119afc32a
SHA1

41e531b5d949326bc504a385973634d6ec25977f
SHA256

1360fbabcfa85acb7b27d5f19fd93930b379f35d243a6ad0503f004df81607fc
SHA512

218bc6047014ce08737a4cc1e500f63529fc2cf32acbceb46cc1651e5f0c589ba7d58cdbf3e441e76d7e772356da23d33a070a0210fc8a0908ba03f13efa1e07
SSDEEP

3072:hMBUds8+ubGHGYJKk/R/AMUMlVFkgEd9x55dJmnS:h2UtSGGKk/NFZlVSd3CS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d381381d20a635686703ba119afc32a_mafia_JC.exe

Files

4d381381d20a635686703ba119afc32a_mafia_JC.exe
.exe windows x86

2c0eca90eeb32df33e4a034f87fc68cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
inet_addr
WSAResetEvent
WSAGetOverlappedResult
WSAWaitForMultipleEvents
WSACloseEvent
WSARecv
WSACreateEvent
send
shutdown
ntohs
WSASocketW
WSACleanup
closesocket
connect
htons
WSAGetLastError
inet_ntoa

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses
NotifyAddrChange

dbghelp

MiniDumpWriteDump

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetFileAttributesA
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetLastError
TlsFree
TlsSetValue
HeapAlloc
GetProcessHeap
HeapFree
CreateThread
CloseHandle
Sleep
SetEvent
WaitForSingleObject
ResetEvent
GetExitCodeThread
CreateEventW
InitializeCriticalSection
GetLocaleInfoW
GetCurrentProcess
GetLocalTime
GetModuleFileNameA
CreateFileA
OutputDebugStringW
WriteFile
CreateProcessW
GetLastError
EnterCriticalSection
CreateNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
LeaveCriticalSection
TerminateProcess
FlushFileBuffers
CreatePipe
SetHandleInformation
ReadFile
GetCurrentThreadId
GetCurrentProcessId
lstrcmpiW
SetUnhandledExceptionFilter
GetModuleFileNameW
GetTickCount
FormatMessageW
OutputDebugStringA
LocalFree
GetLocaleInfoA
EnumSystemLocalesA
CreateFileW
IsValidLocale
GetStringTypeW
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
CreateProcessA
DuplicateHandle
HeapReAlloc
RaiseException
RtlUnwind
CompareStringW
MultiByteToWideChar
GetCPInfo
WideCharToMultiByte
LCMapStringW
UnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetProcAddress
GetModuleHandleW
ExitProcess
GetStdHandle
IsProcessorFeaturePresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue

advapi32

RegCloseKey
StartServiceW
DeleteService
ControlService
QueryServiceStatusEx
OpenServiceW
ChangeServiceConfig2W
CloseServiceHandle
CreateServiceW
OpenSCManagerW
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RegQueryValueExW
RegOpenKeyExW

Sections

.text
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c0eca90eeb32df33e4a034f87fc68cf

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

iphlpapi

dbghelp

version

kernel32

advapi32

Sections

.text Size: 114KB - Virtual size: 114KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 1024B - Virtual size: 840B

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 114KB - Virtual size: 114KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 840B

.reloc
Size: 9KB - Virtual size: 9KB